How to Recover a File Quarantined by Windows Defender on Windows 10

If Microsoft Defender Antivirus on Windows 10 quarantined a file you trust, the best place to recover it is Windows Security, not a third-party undelete tool. Open Virus & threat protection > Protection history, inspect the detection, and use Restore only when you are confident the file is a false positive. Microsoft notes that restoring a quarantined file can cause Defender to detect it again; if that happens, you must review the new alert and choose Allow on device only if you are sure the file is safe.

Security warning: Do not restore or allow a file merely because you need it. Confirm the file's source, path, publisher or signature when available, and why Defender flagged it. If you are unsure, leave it quarantined and obtain a clean copy from a trusted source.

How to restore a quarantined file in Windows Defender

1. Open Windows Security. Select Start, search for Windows Security, and open the app.
2. Open Protection history. Select Virus & threat protection, then choose Protection history. Microsoft says administrator privileges are required to review threat details, and Protection history keeps events for about two weeks.

3. Find the quarantined item. Expand the relevant card and verify the affected file path and detection. If the page offers filtering, choose the quarantined-items view to narrow the list.
4. Choose Restore. For an entry labeled Threat quarantined, open Actions and select Restore. This puts the file back on the device.

5. Handle the new detection if Defender flags the file again. Microsoft documents that a restored file may immediately create a new Threat found - action needed entry. Open that alert, select Actions, and choose Allow on device only if you are certain the detection is a false positive.

For Microsoft's current instructions, see Protection History in the Windows Security app and Restore quarantined files in Microsoft Defender Antivirus.

Restore, Allow on device, and Remove are not the same

If Protection history says Threat blocked rather than Threat quarantined, Microsoft says the threat has already been blocked and removed. In that state, choosing Allow affects what happens the next time Defender sees the file; it does not restore the already removed copy. If the source is trusted, allow it and download a fresh copy from the original source.

What if Defender already removed the file?

If the file is no longer available in quarantine and you cannot download it again, first check your normal backup or File History. For a file that was deleted from local storage and is not in the Recycle Bin, Microsoft's Windows File Recovery command-line app can be a last-resort option.

Stop using the source drive as much as possible before recovery. Deleted-file data can be overwritten by normal computer activity. Microsoft also requires the recovery destination to be on a different drive from the source.

For example, to search a recently deleted NTFS system drive for Word documents and write recovered files to drive E:, a typical command is:

winfr C: E: /regular /n *.docx

Use Regular mode for recently deleted files on a healthy NTFS drive. Microsoft recommends Extensive mode when a file was deleted longer ago, the disk was formatted or corrupted, or the source uses FAT or exFAT. Recovery is never guaranteed, especially after the free space has been overwritten. See Microsoft's Windows File Recovery guide for the current syntax and mode guidance.

If the Restore option is missing

• Make sure you opened an item labeled Threat quarantined; a Threat blocked item may already be gone.
• Check the date. Protection History keeps events for about two weeks, so older entries can disappear.
• Use an administrator account to view full threat details and actions.
• On a work or school PC, security policy may restrict these controls; contact your IT administrator instead of disabling protection.

Avoid turning off real-time protection or adding broad folder exclusions just to recover one file. A narrow decision on a verified false positive leaves the rest of Defender's protection in place, and you can later review allowed items from the Allowed threats page.

A note about Windows 10 in 2026

Microsoft ended standard Windows 10 support on October 14, 2025. Windows 10 PCs still run, and eligible systems can use Extended Security Updates, but Microsoft recommends moving to a supported Windows version where possible. See Microsoft's Windows 10 end-of-support guidance for current options.